Skip to content
OpenAdvisories

Vendor

XenForo

25 known vulnerabilities.

Products

XenForo 25
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.8
    CVE-2026-73318 Public exploit

    XenForo < 2.3.13 Missing Authorization via force-agreement Controller

    XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to access and submit force-agreement forms regardless of their assigned permissions. Attackers can bypass the option permi…

    XenForo XenForo
  • Low 2.7
    CVE-2026-73317 Public exploit

    XenForo < 2.3.13 Missing Authorization via ACP Cache-Rebuild Dispatcher

    XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators with only the rebuildCache permission to perform unauthorized approval queue actions by supplying an arbitrary job clas…

    XenForo XenForo